Commit e88a5cfc authored by Matt Caswell's avatar Matt Caswell
Browse files

Disallow multiple protocol flags to s_server and s_client 



We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2".
The only time multiple flags are allowed is where they are all "-no_<prot>".

This fixes Github Issue #1268

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent 23aec606

apps/s_apps.h

+2 −1
Original line number Diff line number Diff line
@@ -199,7 +199,8 @@ int load_excert(SSL_EXCERT **pexc, BIO *err); 
void print_ssl_summary(BIO *bio, SSL *s);

#ifdef HEADER_SSL_H

int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,

             int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr);

             int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr,

             int *no_prot_opt);

int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,

                  STACK_OF(OPENSSL_STRING) *str, int no_ecdhe, int no_jpake);

int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL) *crls,

apps/s_cb.c

+8 −1
Original line number Diff line number Diff line
@@ -1507,11 +1507,18 @@ void print_ssl_summary(BIO *bio, SSL *s) 
}



int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,

             int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr)

             int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr,

             int *no_prot_opt)

{

    char *arg = **pargs, *argn = (*pargs)[1];

    int rv;



    if (strcmp(arg, "-no_ssl2") == 0 || strcmp(arg, "-no_ssl3") == 0

        || strcmp(arg, "-no_tls1") == 0 || strcmp(arg, "-no_tls1_1") == 0

        || strcmp(arg, "-no_tls1_2") == 0) {

        *no_prot_opt = 1;

    }



    /* Attempt to run SSL configuration command */

    rv = SSL_CONF_cmd_argv(cctx, pargc, pargs);

    /* If parameter not recognised just return */

apps/s_client.c

+30 −6
Original line number Diff line number Diff line
@@ -744,6 +744,7 @@ int MAIN(int argc, char **argv) 
    int crl_format = FORMAT_PEM;

    int crl_download = 0;

    STACK_OF(X509_CRL) *crls = NULL;

    int prot_opt = 0, no_prot_opt = 0;



    meth = SSLv23_client_method();
@@ -847,7 +848,8 @@ int MAIN(int argc, char **argv) 
            if (badarg)

                goto bad;

            continue;

        } else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args)) {

        } else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args,

                            &no_prot_opt)) {

            if (badarg)

                goto bad;

            continue;
@@ -939,31 +941,42 @@ int MAIN(int argc, char **argv) 
        }

#endif

#ifndef OPENSSL_NO_SSL2

        else if (strcmp(*argv, "-ssl2") == 0)

        else if (strcmp(*argv, "-ssl2") == 0) {

            meth = SSLv2_client_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_SSL3_METHOD

        else if (strcmp(*argv, "-ssl3") == 0)

        else if (strcmp(*argv, "-ssl3") == 0) {

            meth = SSLv3_client_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_TLS1

        else if (strcmp(*argv, "-tls1_2") == 0)

        else if (strcmp(*argv, "-tls1_2") == 0) {

            meth = TLSv1_2_client_method();

        else if (strcmp(*argv, "-tls1_1") == 0)

            prot_opt++;

        } else if (strcmp(*argv, "-tls1_1") == 0) {

            meth = TLSv1_1_client_method();

        else if (strcmp(*argv, "-tls1") == 0)

            prot_opt++;

        } else if (strcmp(*argv, "-tls1") == 0) {

            meth = TLSv1_client_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_DTLS1

        else if (strcmp(*argv, "-dtls") == 0) {

            meth = DTLS_client_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-dtls1") == 0) {

            meth = DTLSv1_client_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-dtls1_2") == 0) {

            meth = DTLSv1_2_client_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-timeout") == 0)

            enable_timeouts = 1;

        else if (strcmp(*argv, "-mtu") == 0) {
@@ -1146,6 +1159,17 @@ int MAIN(int argc, char **argv) 
    }

#endif



    if (prot_opt > 1) {

        BIO_printf(bio_err, "Cannot supply multiple protocol flags\n");

        goto end;

    }



    if (prot_opt == 1 && no_prot_opt) {

        BIO_printf(bio_err, "Cannot supply both a protocol flag and "

                            "\"-no_<prot>\"\n");

        goto end;

    }



    OpenSSL_add_ssl_algorithms();

    SSL_load_error_strings();

apps/s_server.c

+22 −1
Original line number Diff line number Diff line
@@ -1137,6 +1137,7 @@ int MAIN(int argc, char *argv[]) 
    int crl_format = FORMAT_PEM;

    int crl_download = 0;

    STACK_OF(X509_CRL) *crls = NULL;

    int prot_opt = 0, no_prot_opt = 0;



    meth = SSLv23_server_method();
@@ -1300,7 +1301,8 @@ int MAIN(int argc, char *argv[]) 
            if (badarg)

                goto bad;

            continue;

        } else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args)) {

        } else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args,

                            &no_prot_opt)) {

            if (badarg)

                goto bad;

            continue;
@@ -1444,32 +1446,40 @@ int MAIN(int argc, char *argv[]) 
        else if (strcmp(*argv, "-ssl2") == 0) {

            no_ecdhe = 1;

            meth = SSLv2_server_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_SSL3_METHOD

        else if (strcmp(*argv, "-ssl3") == 0) {

            meth = SSLv3_server_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_TLS1

        else if (strcmp(*argv, "-tls1") == 0) {

            meth = TLSv1_server_method();

            prot_opt++;

        } else if (strcmp(*argv, "-tls1_1") == 0) {

            meth = TLSv1_1_server_method();

            prot_opt++;

        } else if (strcmp(*argv, "-tls1_2") == 0) {

            meth = TLSv1_2_server_method();

            prot_opt++;

        }

#endif

#ifndef OPENSSL_NO_DTLS1

        else if (strcmp(*argv, "-dtls") == 0) {

            meth = DTLS_server_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-dtls1") == 0) {

            meth = DTLSv1_server_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-dtls1_2") == 0) {

            meth = DTLSv1_2_server_method();

            socket_type = SOCK_DGRAM;

            prot_opt++;

        } else if (strcmp(*argv, "-timeout") == 0)

            enable_timeouts = 1;

        else if (strcmp(*argv, "-mtu") == 0) {
@@ -1579,6 +1589,17 @@ int MAIN(int argc, char *argv[]) 
    }

#endif



    if (prot_opt > 1) {

        BIO_printf(bio_err, "Cannot supply multiple protocol flags\n");

        goto end;

    }



    if (prot_opt == 1 && no_prot_opt) {

        BIO_printf(bio_err, "Cannot supply both a protocol flag and "

                            "\"-no_<prot>\"\n");

        goto end;

    }



    SSL_load_error_strings();

    OpenSSL_add_ssl_algorithms();